Infosys’ blog on industry solutions, trends, business process transformation and global implementation in Oracle.

« Dairy Industry Challenges & Oracle's Solution | Main | Leveraging Technology - Retaining corporate knowledge in an Ageing workforce situation »

Use RBAC to secure your eBiz suite

To realize the early benefits of an ERP implementation and to comply with all the legal requirements, it is important that the applications and data are properly secured by exploring all the available security option within Oracle Applications

Oracle ebiz suite has various security features like:
a) Application Security using Access Control, Identity Management , Password Management etc
b) Physical Data Security using oracle database security , back ups etc
c) Security for imodules using firewalls, proxies etc

As part of Application security, User Management or RBAC (Role Based Access Control) was introduced by Oracle few years back, the major features of User management are:

- In the User Management model, a role would point to a set of functions and separately point to a navigation menu that should be used to access those functions.
- This navigation menu may contain a superset of functions but only those functions which have been granted to the user (via the roles) would be enabled (other functions would be filtered out)
- The navigation menu can be organized in the most intuitive way for finding functions in the navigator, while the roles can be defined purely based on the security / organization requirements

What is the difference with the traditional Responsibility approach?

Under User Management / RBAC, rather than presenting the user with a list of responsibilities which may have the same menu or slightly altered versions of the same menu presented multiple times, one would present the user with a list of product areas, and all the functions which they can access in that product area regardless of the role through which the function was given.

RBAC / User Management still has long way to go with challenges like an organization should have a clear RACI(Responsibility-Accountability-Consultation-Information) matrix defined with proper roles but eventually it would replace the Responsibility based security model of oracle. 

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)

Please key in the two words you see in the box to validate your identity as an authentic user and reduce spam.

Subscribe to this blog's feed

Follow us on

Blogger Profiles